I wasn't able to reproduce it without the plugin/server that is able to
expand the nested member attributes on its own - although I think it
should be reproducible even without it, since we use only one hash user
and group table per the whole request.
Nevertheless, the patch is simple and safe.